Merge remote-tracking branch 'origin/f28' into f28-user-thl-vanilla-fedora

4 files changed, 242 insertions, 128 deletions

diff --git a/Revert-iommu-intel-iommu-Enable-CONFIG_DMA_DIRECT_OP.patch b/Revert-iommu-intel-iommu-Enable-CONFIG_DMA_DIRECT_OP.patch
deleted file mode 100644
index 46212341f..000000000
--- a/Revert-iommu-intel-iommu-Enable-CONFIG_DMA_DIRECT_OP.patch
+++ /dev/null
@@ -1,125 +0,0 @@
-From 3c16e0cc4ace8bd838bf234caead5a766b07fe9d Mon Sep 17 00:00:00 2001
-From: Christoph Hellwig <hch@lst.de>
-Date: Thu, 5 Jul 2018 13:29:55 -0600
-Subject: [PATCH] Revert "iommu/intel-iommu: Enable CONFIG_DMA_DIRECT_OPS=y and
- clean up intel_{alloc,free}_coherent()"
-
-This commit may cause a less than required dma mask to be used for
-some allocations, which apparently leads to module load failures for
-iwlwifi sometimes.
-
-This reverts commit d657c5c73ca987214a6f9436e435b34fc60f332a.
-
-Signed-off-by: Christoph Hellwig <hch@lst.de>
-Reported-by: Fabio Coatti <fabio.coatti@gmail.com>
-Tested-by: Fabio Coatti <fabio.coatti@gmail.com>
-Signed-off-by: Jeremy Cline <jcline@redhat.com>
----
- drivers/iommu/Kconfig       |  1 -
- drivers/iommu/intel-iommu.c | 62 +++++++++++++++++++++++++++----------
- 2 files changed, 46 insertions(+), 17 deletions(-)
-
-diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
-index b38798cc5288..f3a21343e636 100644
---- a/drivers/iommu/Kconfig
-+++ b/drivers/iommu/Kconfig
-@@ -142,7 +142,6 @@ config DMAR_TABLE
- config INTEL_IOMMU
- 	bool "Support for Intel IOMMU using DMA Remapping Devices"
- 	depends on PCI_MSI && ACPI && (X86 || IA64_GENERIC)
--	select DMA_DIRECT_OPS
- 	select IOMMU_API
- 	select IOMMU_IOVA
- 	select DMAR_TABLE
-diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
-index 749d8f235346..6392a4964fc5 100644
---- a/drivers/iommu/intel-iommu.c
-+++ b/drivers/iommu/intel-iommu.c
-@@ -31,7 +31,6 @@
- #include <linux/pci.h>
- #include <linux/dmar.h>
- #include <linux/dma-mapping.h>
--#include <linux/dma-direct.h>
- #include <linux/mempool.h>
- #include <linux/memory.h>
- #include <linux/cpu.h>
-@@ -3709,30 +3708,61 @@ static void *intel_alloc_coherent(struct device *dev, size_t size,
- 				  dma_addr_t *dma_handle, gfp_t flags,
- 				  unsigned long attrs)
- {
--	void *vaddr;
-+	struct page *page = NULL;
-+	int order;
- 
--	vaddr = dma_direct_alloc(dev, size, dma_handle, flags, attrs);
--	if (iommu_no_mapping(dev) || !vaddr)
--		return vaddr;
-+	size = PAGE_ALIGN(size);
-+	order = get_order(size);
- 
--	*dma_handle = __intel_map_single(dev, virt_to_phys(vaddr),
--			PAGE_ALIGN(size), DMA_BIDIRECTIONAL,
--			dev->coherent_dma_mask);
--	if (!*dma_handle)
--		goto out_free_pages;
--	return vaddr;
-+	if (!iommu_no_mapping(dev))
-+		flags &= ~(GFP_DMA | GFP_DMA32);
-+	else if (dev->coherent_dma_mask < dma_get_required_mask(dev)) {
-+		if (dev->coherent_dma_mask < DMA_BIT_MASK(32))
-+			flags |= GFP_DMA;
-+		else
-+			flags |= GFP_DMA32;
-+	}
-+
-+	if (gfpflags_allow_blocking(flags)) {
-+		unsigned int count = size >> PAGE_SHIFT;
-+
-+		page = dma_alloc_from_contiguous(dev, count, order, flags);
-+		if (page && iommu_no_mapping(dev) &&
-+		    page_to_phys(page) + size > dev->coherent_dma_mask) {
-+			dma_release_from_contiguous(dev, page, count);
-+			page = NULL;
-+		}
-+	}
-+
-+	if (!page)
-+		page = alloc_pages(flags, order);
-+	if (!page)
-+		return NULL;
-+	memset(page_address(page), 0, size);
-+
-+	*dma_handle = __intel_map_single(dev, page_to_phys(page), size,
-+					 DMA_BIDIRECTIONAL,
-+					 dev->coherent_dma_mask);
-+	if (*dma_handle)
-+		return page_address(page);
-+	if (!dma_release_from_contiguous(dev, page, size >> PAGE_SHIFT))
-+		__free_pages(page, order);
- 
--out_free_pages:
--	dma_direct_free(dev, size, vaddr, *dma_handle, attrs);
- 	return NULL;
- }
- 
- static void intel_free_coherent(struct device *dev, size_t size, void *vaddr,
- 				dma_addr_t dma_handle, unsigned long attrs)
- {
--	if (!iommu_no_mapping(dev))
--		intel_unmap(dev, dma_handle, PAGE_ALIGN(size));
--	dma_direct_free(dev, size, vaddr, dma_handle, attrs);
-+	int order;
-+	struct page *page = virt_to_page(vaddr);
-+
-+	size = PAGE_ALIGN(size);
-+	order = get_order(size);
-+
-+	intel_unmap(dev, dma_handle, size);
-+	if (!dma_release_from_contiguous(dev, page, size >> PAGE_SHIFT))
-+		__free_pages(page, order);
- }
- 
- static void intel_unmap_sg(struct device *dev, struct scatterlist *sglist,
--- 
-2.17.1
-
diff --git a/kernel.spec b/kernel.spec
index bc6f70328..bde564bcf 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -134,6 +134,10 @@ Summary: The Linux kernel
 # See also 'make debug' and 'make release'.
 %define debugbuildsenabled 1
 
+# Kernel headers are being split out into a separate package
+%define with_headers 0
+%define with_cross_headers 0
+
 %if %{with_verbose}
 %define make_opts V=1
 %else
@@ -628,6 +632,9 @@ Patch330: bcm2837-rpi-initial-3plus-support.patch
 Patch332: bcm2837-enable-pmu.patch
 Patch333: bcm2837-lan78xx-fixes.patch
 
+# https://patchwork.kernel.org/patch/10547897/
+Patch334: net-lan78xx-fix-rx-handling-before-first-packet-is-send.patch
+
 # 400 - IBM (ppc/s390x) patches
 
 # 500 - Temp fixes/CVEs etc
@@ -684,12 +691,12 @@ Patch523: 0001-xfs-More-robust-inode-extent-count-validation.patch
 # rhbz 1597333
 # Patch526: xhci-Fix-perceived-dead-host-due-to-runtime-suspend-.patch
 
-# rbhz 1607092
-Patch528: Revert-iommu-intel-iommu-Enable-CONFIG_DMA_DIRECT_OP.patch
-
 # rhbz 1602971
 Patch529: ext4-fix-false-negative-and-false-positives.patch
 
+# CVE-2018-14678 rhbz 1608559 1608560
+Patch530: xsa274-linux-4_17.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1942,6 +1949,14 @@ fi
 #
 #
 %changelog
+* Wed Aug  1 2018 Peter Robinson <pbrobinson@fedoraproject.org>
+- Add fix for lan78xx RX packets (Raspberry Pi 3B+)
+
+* Mon Jul 30 2018 Justin M. Forbes <jforbes@fedoraproject.org> - 4.17.11-200
+- Linux v4.17.11
+- Turn off kernel-headers for the split
+- Fix CVE-2018-14678 (rhbz 1608559 1608560)
+
 * Wed Jul 25 2018 Justin M. Forbes <jforbes@fedoraproject.org> - 4.17.10-200
 - Linux v4.17.10
 
diff --git a/net-lan78xx-fix-rx-handling-before-first-packet-is-send.patch b/net-lan78xx-fix-rx-handling-before-first-packet-is-send.patch
new file mode 100644
index 000000000..d4726ad8f
--- /dev/null
+++ b/net-lan78xx-fix-rx-handling-before-first-packet-is-send.patch
@@ -0,0 +1,97 @@
+From patchwork Sat Jul 28 07:52:10 2018
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Stefan Wahren <stefan.wahren@i2se.com>
+X-Patchwork-Id: 10547897
+Return-Path: <linux-usb-owner@kernel.org>
+Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org
+ [172.30.200.125])
+	by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0E30E13BF
+	for <patchwork-linux-usb@patchwork.kernel.org>;
+ Sat, 28 Jul 2018 07:53:14 +0000 (UTC)
+Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1])
+	by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0007D28505
+	for <patchwork-linux-usb@patchwork.kernel.org>;
+ Sat, 28 Jul 2018 07:53:13 +0000 (UTC)
+Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486)
+	id E44B22B5DF; Sat, 28 Jul 2018 07:53:13 +0000 (UTC)
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
+	pdx-wl-mail.web.codeaurora.org
+X-Spam-Level: 
+X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI,
+	RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1
+Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
+	by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5462E28505
+	for <patchwork-linux-usb@patchwork.kernel.org>;
+ Sat, 28 Jul 2018 07:53:13 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S1726185AbeG1JSf (ORCPT
+        <rfc822;patchwork-linux-usb@patchwork.kernel.org>);
+        Sat, 28 Jul 2018 05:18:35 -0400
+Received: from mout.kundenserver.de ([212.227.17.10]:52173 "EHLO
+        mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S1726061AbeG1JSf (ORCPT
+        <rfc822;linux-usb@vger.kernel.org>); Sat, 28 Jul 2018 05:18:35 -0400
+Received: from localhost.localdomain ([37.4.249.97]) by
+ mrelayeu.kundenserver.de (mreue102 [212.227.15.183]) with ESMTPSA (Nemesis)
+ id 0MUVwx-1fbNw12XvX-00REnE; Sat, 28 Jul 2018 09:52:50 +0200
+From: Stefan Wahren <stefan.wahren@i2se.com>
+To: Woojung Huh <woojung.huh@microchip.com>,
+        UNGLinuxDriver@microchip.com,
+        "David S. Miller" <davem@davemloft.net>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
+        Dave Stevenson <dave.stevenson@raspberrypi.org>,
+        netdev@vger.kernel.org, linux-usb@vger.kernel.org,
+        Stefan Wahren <stefan.wahren@i2se.com>
+Subject: [PATCH] net: lan78xx: fix rx handling before first packet is send
+Date: Sat, 28 Jul 2018 09:52:10 +0200
+Message-Id: <1532764330-14522-1-git-send-email-stefan.wahren@i2se.com>
+X-Mailer: git-send-email 2.7.4
+X-Provags-ID: V03:K1:1UgD7xV2Hs3djVASkjGZexXrelNVV9KQ4W/KMZ/6ZAjOD8iCVVb
+ 8jgtNmA1TZYvTOLPwIOhlB8fkrx6AkSXGQRQtE1q6zNBYDYszenIppRha2tGTSDIR8dnhZs
+ tmeCWOtaIFiYiDYuCEtYrYgFELx1btCiQS8Ibc237s0SLbaPNnQ369IwfgO4dQdcdOZuixw
+ Ugo4KTjNh2qR2Hp4FWD7g==
+X-UI-Out-Filterresults: notjunk:1;V01:K0:JyYP1ZeZOl0=:98L7zdWnTjAX3Fa+4Pqc+f
+ T3TiXkUfXJyEJ+QxnkwcBp0LXo+7/LWQ7h4/cZJnHF7Uo8bsvljCcRVGmMhx5Cy46MtNZvUED
+ CW5cOvXktUAucStGptcPE+qDnRJ6ruaSzDuwc/A7tBqW518YK/KyASr+EwASjmyvcqOYMVd6M
+ ZAP4in8S1PqQ98w3Ya3wxpz4heiv9J6xbs1HGSjNCBs0T80zp9ufdlNqCz7QBJ/07LlheZPkh
+ TeMhKHNUoaqIq2wfm/LT2+O9oO4hBPB1kGcwj50z5oPO86MXeJWtoUx8JKU8l+56tWQydlhc7
+ PYFqGBnCG+krEz6Eoh1CM+KJIh1CrmlteojK38ny/GllmThwPLrXsVrVaUPoZ38gduQz3Ug5+
+ gyOA7CU3L/eamlSo1XevvLRdv8ObDF5V82qTvBANHqEg5ZAW0MIe/hhIGKArtR1jpXSOan4M6
+ lY6ejQh3ZBtliMvpjoPCWh3ivl7hQpi+Cm4cQrJeq1DuB1MbGJQfZXCieSBUJkhi7y8YLzuN6
+ N2QlDoLCXzmrz2N2Fcx69oKVIKOfWVk9wgXlYKNG7Ovd8KT0jVwG8WpWRKhRTwsJYWvRY9+Rc
+ MA7jSxJSgtBSA/cs12dACWJ8rkaA9uezD1g8YRFSJDf/IXXUqWmONuPGAh89RtCr+lMQne/oY
+ da1rqaBklRMhegBeJ1yrYFkyuyoWztMMC7JbjrM7lMHkOfhih49WDkWBTGZvdEwTc+Ps=
+Sender: linux-usb-owner@vger.kernel.org
+Precedence: bulk
+List-ID: <linux-usb.vger.kernel.org>
+X-Mailing-List: linux-usb@vger.kernel.org
+X-Virus-Scanned: ClamAV using ClamSMTP
+
+As long the bh tasklet isn't scheduled once, no packet from the rx path
+will be handled. Since the tx path also schedule the same tasklet
+this situation only persits until the first packet transmission.
+So fix this issue by scheduling the tasklet after link reset.
+
+Link: https://github.com/raspberrypi/linux/issues/2617
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet")
+Suggested-by: Floris Bos <bos@je-eigen-domein.nl>
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+---
+ drivers/net/usb/lan78xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index ed10d49..aeca484 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1242,6 +1242,8 @@ static int lan78xx_link_reset(struct lan78xx_net *dev)
+ 			mod_timer(&dev->stat_monitor,
+ 				  jiffies + STAT_UPDATE_TIMER);
+ 		}
++
++		tasklet_schedule(&dev->bh);
+ 	}
+ 
+ 	return ret;
diff --git a/xsa274-linux-4_17.patch b/xsa274-linux-4_17.patch
new file mode 100644
index 000000000..7a9bbf768
--- /dev/null
+++ b/xsa274-linux-4_17.patch
@@ -0,0 +1,127 @@
+From 8df635007e0737887522eebee886155602b8809b Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@kernel.org>
+Date: Sun, 22 Jul 2018 11:05:09 -0700
+Subject: [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
+
+error_entry and error_exit communicate the user vs kernel status of
+the frame using %ebx.  This is unnecessary -- the information is in
+regs->cs.  Just use regs->cs.
+
+This makes error_entry simpler and makes error_exit more robust.
+
+It also fixes a nasty bug.  Before all the Spectre nonsense, The
+xen_failsafe_callback entry point returned like this:
+
+        ALLOC_PT_GPREGS_ON_STACK
+        SAVE_C_REGS
+        SAVE_EXTRA_REGS
+        ENCODE_FRAME_POINTER
+        jmp     error_exit
+
+And it did not go through error_entry.  This was bogus: RBX
+contained garbage, and error_exit expected a flag in RBX.
+Fortunately, it generally contained *nonzero* garbage, so the
+correct code path was used.  As part of the Spectre fixes, code was
+added to clear RBX to mitigate certain speculation attacks.  Now,
+depending on kernel configuration, RBX got zeroed and, when running
+some Wine workloads, the kernel crashes.  This was introduced by:
+
+    commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
+    exceptions/interrupts, to reduce speculation attack surface")
+
+With this patch applied, RBX is no longer needed as a flag, and the
+problem goes away.
+
+I suspect that malicious userspace could use this bug to crash the
+kernel even without the offending patch applied, though.
+
+[Historical note: I wrote this patch as a cleanup before I was aware
+ of the bug it fixed.]
+
+[Note to stable maintainers: this should probably get applied to all
+ kernels.  If you're nervous about that, a more conservative fix to
+ add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
+ also fix the problem.]
+
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Dominik Brodowski <linux@dominikbrodowski.net>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: xen-devel@lists.xenproject.org
+Cc: x86@kernel.org
+Cc: stable@vger.kernel.org
+Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
+Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+---
+ arch/x86/entry/entry_64.S | 18 ++++--------------
+ 1 file changed, 4 insertions(+), 14 deletions(-)
+
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index 73a522d53b53..8ae7ffda8f98 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -981,7 +981,7 @@ ENTRY(\sym)
+ 
+ 	call	\do_sym
+ 
+-	jmp	error_exit			/* %ebx: no swapgs flag */
++	jmp	error_exit
+ 	.endif
+ END(\sym)
+ .endm
+@@ -1222,7 +1222,6 @@ END(paranoid_exit)
+ 
+ /*
+  * Save all registers in pt_regs, and switch GS if needed.
+- * Return: EBX=0: came from user mode; EBX=1: otherwise
+  */
+ ENTRY(error_entry)
+ 	UNWIND_HINT_FUNC
+@@ -1269,7 +1268,6 @@ ENTRY(error_entry)
+ 	 * for these here too.
+ 	 */
+ .Lerror_kernelspace:
+-	incl	%ebx
+ 	leaq	native_irq_return_iret(%rip), %rcx
+ 	cmpq	%rcx, RIP+8(%rsp)
+ 	je	.Lerror_bad_iret
+@@ -1303,28 +1301,20 @@ ENTRY(error_entry)
+ 
+ 	/*
+ 	 * Pretend that the exception came from user mode: set up pt_regs
+-	 * as if we faulted immediately after IRET and clear EBX so that
+-	 * error_exit knows that we will be returning to user mode.
++	 * as if we faulted immediately after IRET.
+ 	 */
+ 	mov	%rsp, %rdi
+ 	call	fixup_bad_iret
+ 	mov	%rax, %rsp
+-	decl	%ebx
+ 	jmp	.Lerror_entry_from_usermode_after_swapgs
+ END(error_entry)
+ 
+-
+-/*
+- * On entry, EBX is a "return to kernel mode" flag:
+- *   1: already in kernel mode, don't need SWAPGS
+- *   0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
+- */
+ ENTRY(error_exit)
+ 	UNWIND_HINT_REGS
+ 	DISABLE_INTERRUPTS(CLBR_ANY)
+ 	TRACE_IRQS_OFF
+-	testl	%ebx, %ebx
+-	jnz	retint_kernel
++	testb	$3, CS(%rsp)
++	jz	retint_kernel
+ 	jmp	retint_user
+ END(error_exit)
+ 
+-- 
+2.18.0
+